AWS Site-to-Site VPN Connection
Does ZopNight manage AWS Site-to-Site VPN Connection?
An AWS Site-to-Site VPN connection bills per connection-hour whether or not either tunnel carries traffic. RC-162 requires a TunnelState peak of 0 and a combined data peak at or below 1 MiB, both across a fully covered 30-day window, before reporting the connection as abandoned.
Rules that fire on AWS Site-to-Site VPN Connection
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery, metrics, cost tracking, and recommendations only. |
A Site-to-Site VPN connection joins a VPC to a network you run elsewhere over two IPsec tunnels. The charge is for the connection existing, which is what makes a migration leftover expensive.
The hour bills, not the traffic
Every hour a VPN connection exists carries a charge, plus data transfer for whatever crosses it. A connection whose tunnels have been down since a datacentre move finished still bills the same hourly rate as one carrying production replication. That is the shape of the waste this resource type produces: not a spike, but a flat line nobody questions because it is small per hour and permanent.
Three axes, and all of them read as peaks
RC-162 VPN Connection Idle, No Tunnels Up reads three series that the metrics pipeline harvests at the connection level: the tunnel state gauge, and the data in and data out counters. All three are evaluated as window peaks. The tunnel test is a peak of 0 on the state gauge, which is the conservative way to say the tunnel was never up, because a single moment of connectivity anywhere in the window lifts the peak above zero. The traffic test is a combined data peak at or below 1 MiB, which tolerates the keep-alive and dead-peer-detection bytes an up-but-unused tunnel still emits.
A tunnel count is a moment, not evidence
Discovery records how many tunnels were up when it last looked. The rule deliberately does not use it. A point-in-time count says nothing about the 30 days either side of it, and an abandoned-connection verdict that leads to deletion needs a window, not a snapshot. Reading the metric series instead of the discovered flag is the difference between evidence and coincidence.
Coverage before conclusions
Detection requires 30 days of data on every gating axis. An under-measured connection is never called idle, because absent data is not the same as absent traffic. This is stricter than the platform’s generic coverage floor, for the same reason the VPC endpoint rule is stricter: the recommendation recovers the full cost of the resource, so it recommends removing something, and a short quiet spell is not proof of abandonment.
Reading tunnel state directly
The connection detail in the console shows both tunnels and their current status, and the CLI gives the same view for every connection at once, which is usually the faster way to spot the ones that have been down for months.